ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  test:
    name: Test (${{ matrix.os }}, Node ${{ matrix.node-version }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        # Windows is intentionally excluded from the unit-test matrix:
        # node-pty's `conpty_console_list_agent.js` helper crashes
        # repeatedly with "AttachConsole failed" on the GitHub Actions
        # Windows runner, leaving zombie file handles that hang per-file
        # workers past the 180s test-timeout. Every code path tested
        # here is also exercised on Linux + macOS, so we lose no
        # coverage. Windows-specific behavior (PTY shell launch + UI)
        # is still covered end-to-end by the `e2e (windows-latest)`
        # job below, which is the only Windows test path that actually
        # catches Windows-specific bugs.
        os: [ubuntu-latest, macos-latest]
        # Node 20 dropped after EOL (2026-04-30). See package.json engines.
        node-version: [22, 24]
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm
      - run: npm ci
      - name: Build frontend
        run: cd src/frontend && npm ci && npm run build
      - run: npm test

  coverage:
    name: Coverage
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - name: Build frontend
        run: cd src/frontend && npm ci && npm run build
      - run: npm run test:coverage
      - name: Coverage Report
        if: github.event_name == 'pull_request'
        uses: davelosert/vitest-coverage-report-action@3c054a2d2e2ca45446417ad5d6d5eb33092af8f1 # v2
        with:
          json-summary-path: coverage/coverage-summary.json
          json-final-path: coverage/coverage-final.json
          file-coverage-mode: all
      - name: Update coverage badge
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        run: |
          COVERAGE=$(node -e "const c = require('./coverage/coverage-summary.json'); console.log(c.total.lines.pct)")
          if (( $(echo "$COVERAGE >= 90" | bc -l) )); then COLOR="brightgreen"
          elif (( $(echo "$COVERAGE >= 75" | bc -l) )); then COLOR="green"
          elif (( $(echo "$COVERAGE >= 60" | bc -l) )); then COLOR="yellowgreen"
          elif (( $(echo "$COVERAGE >= 45" | bc -l) )); then COLOR="yellow"
          else COLOR="red"; fi
          echo "{\"schemaVersion\":1,\"label\":\"coverage\",\"message\":\"${COVERAGE}%\",\"color\":\"${COLOR}\"}" > /tmp/endpoint.json
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          if git fetch origin coverage-data 2>/dev/null; then
            git checkout coverage-data
          else
            git checkout --orphan coverage-data
            git rm -rf . 2>/dev/null || true
          fi
          cp /tmp/endpoint.json endpoint.json
          git add endpoint.json
          git commit -m "Update coverage badge to ${COVERAGE}%" || true
          git push origin coverage-data

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: node --check src/server/*.js src/cli/*.js src/tunnel/*.js src/utils/*.js bin/*.js

  frontend:
    name: Frontend Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - name: Install frontend dependencies
        run: cd src/frontend && npm ci
      - name: Type-check frontend
        run: cd src/frontend && npx tsc --noEmit
      - name: Build frontend
        run: cd src/frontend && npm run build
      - name: Verify build output
        run: test -f public/index.html

  e2e:
    name: E2E (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - name: Build frontend
        run: cd src/frontend && npm ci && npm run build
      - name: Install Playwright (Linux)
        if: runner.os == 'Linux'
        run: npx playwright install --with-deps chromium
      - name: Install Playwright
        if: runner.os != 'Linux'
        run: npx playwright install chromium
      - name: Run E2E tests
        run: npx playwright test
        env:
          CI: true
      - name: Upload Playwright report
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: playwright-report-${{ matrix.os }}
          path: playwright-report/
          retention-days: 7
      - name: Upload test traces
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: playwright-traces-${{ matrix.os }}
          path: test-results/
          retention-days: 7

  devtunnel-install:
    name: DevTunnel Install (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: node --test test/tunnel/devtunnel-install.test.js